OPENSSL_Applink error on Python 3.11.5 Windows 10 2022H2

[daniel-airgus]

Bug report

Checklist

• I am confident this is a bug in CPython, not a bug in a third-party project
• I have searched the CPython issue tracker,
  and am confident this bug has not been reported before

CPython versions tested on:

3.11

Operating systems tested on:

Windows

Output from running 'python -VV' on the command line:

Python 3.11.5 | packaged by conda-forge | (main, Aug 27 2023, 03:23:48) [MSC v.1936 64 bit (AMD64)]

A clear and concise description of the bug:

I am following up on the issue described here
#99079
also described here
#101401

I compile using Cython 3.0.2 on Windows 10 22H2 (Version 10.0.19045.3324) and have installed three different versions of OpenSSL
1.1.1i
1.1.1v
3.0.10

and compile against each version yet I continue to get the same error
OPENSSL_Uplink{00007FFE7BF17068,08}: no OPENSSL_Applink
message when the executable makes an HTTP request using the requests library to an HTTPS endpoint.

I did get this to work with the 3.12.0rc1 version but I need a conda environment around it for all the other package we depend on which is not yet available. This 3.11.5 version works fine on a different Windows machine Version 10.0.18363.657 (older).

In the comment that closed out the issue I am referencing above they stated that 3.11.5 works on the newer version of Windows with OpenSSL 3.X.X. Can you provide detail as to how you got this to work?

[zooba]

Because the applink table is kept in _ssl.pyd and not in python.exe, we patch our build of OpenSSL to look in the right place. If you're building OpenSSL from source, you'll need to apply the same patch.

You'll find the patch in prepare_ssl.py (though we actually patch it somewhere else, as we don't build using this script anymore).

[daniel-airgus]

Thank you, I understand. I have patched the source code per your instruction and rebuilt OpenSSL 3.0.9 and have new DLL files. However, I still get the same error. The _ssl.pyd file comes from the python 3.11.5 environment via PYinstaller,

I added some print statements in uplink.c (confirming that the EXE is reading from the new DDLs) and have found that the output from
applink = (void **(*)())GetProcAddress(h, "OPENSSL_Applink");

is still NULL. This means to me that _ssl.pyd is getting read but that it does not contain the OPENSSL Applink table. It was my understanding from the linked questions and from your answer that _ssl.pyd does contain the Applink table. Is this incorrect?

Thank you for your help!

[zooba]

That surprises me. If the standard _ssl.pyd isn't exporting that symbol, our own tests wouldn't pass and it wouldn't be released.

Are you sure you aren't overwriting the value of h incorrectly and are trying to GetProcAddress(NULL, ...)?

[daniel-airgus]

Thank you for your response. It seems that when I use the _ssl.pyd file packaged in conda it does not work, but when I download the latest python 3.11.5 from the official website it does work. May be interesting for someone to take note. The file sizes are different (the conda one is 166KB while the official python one is 173KB) suggesting that there is indeed an addition in the "official" version of _ssl.pyd. Now, I am no longer getting the Applink error.

However, when I run the executable I make using pyinstaller, (where I replaced the 2 DLLs with the two new ones) and I replace _ssl.pyd as explained, I get a urllib3 error:
urllib3.exceptions.SSLError: Can't connect to HTTPS URL because the SSL module is not available.

I turned off my antivirus for this just in case, but that does not change the situation. I am making an HTTPS request which works from windows CURL and works from the python interpreter of that conda environment.

I am doing this on a clean install of miniconda in an environment setup with all the packages needed for this project and nothing else. Do you have any ideas what could cause urllib3 to fail like this?

Thank you very much!

[zooba]

It seems that when I use the _ssl.pyd file packaged in conda it does not work

They build in a different way, so you'll need to check in with either conda-forge or Anaconda to see what they're doing.

Do you have any ideas what could cause urllib3 to fail like this?

Usually it means that import ssl is failing. Try running that first and you should get a more specific error message, but I'd expect it'll be a vague ImportError complaining about DLLs not loading. Most likely you've linked your builds to some other dependencies but are not including them, assuming it works in your build directory but not after deployment.

[daniel-airgus]

Thank you very much for all your help, I got it to work based on your comments!

[xiaoshame]

Thank you for your response. It seems that when I use the _ssl.pyd file packaged in conda it does not work, but when I download the latest python 3.11.5 from the official website it does work. May be interesting for someone to take note. The file sizes are different (the conda one is 166KB while the official python one is 173KB) suggesting that there is indeed an addition in the "official" version of _ssl.pyd. Now, I am no longer getting the Applink error.感谢您的回复。当我使用conda中打包的_ssl.pyd文件时，它似乎不起作用，但当我从官方网站下载最新的python 3.11.5时，它确实起作用。也许有人会注意到这一点。文件大小不同（conda文件大小为166KB，而python官方文件大小为173KB），这表明_ssl.pyd的“官方”版本中确实添加了一个。现在，我不再收到Applink错误。

However, when I run the executable I make using pyinstaller, (where I replaced the 2 DLLs with the two new ones) and I replace _ssl.pyd as explained, I get a urllib3 error:然而，当我使用pyinstaller运行我制作的可执行文件时（我用两个新的DLL替换了两个DLL），并按照解释替换了_ssl.pyd，我得到了一个urlib3错误： urllib3.exceptions.SSLError: Can't connect to HTTPS URL because the SSL module is not available.urlib3.exceptions.SLError：无法连接到HTTPS URL，因为SSL模块不可用。

I turned off my antivirus for this just in case, but that does not change the situation. I am making an HTTPS request which works from windows CURL and works from the python interpreter of that conda environment.为了以防万一，我关闭了防病毒软件，但这并不能改变现状。我正在进行HTTPS请求，该请求在windows CURL中工作，在conda环境的python解释器中工作。

I am doing this on a clean install of miniconda in an environment setup with all the packages needed for this project and nothing else. Do you have any ideas what could cause urllib3 to fail like this?我在一个环境设置中干净地安装了miniconda，只安装了这个项目所需的所有软件包，没有其他任何东西。你知道是什么导致urllib3像这样失败吗？

Thank you very much!非常感谢！

At first, I only used the official _ssl.pyd replacing _ssl.pyd in conda DLL,but still reports an error. The content in my Python 3.11.5 official DLL covered the content of the conda DLL, and ultimately resolved this issue